Security
Alibaba Used Silent Audio Streams to Fingerprint Site Visitors
A developer uncovered hidden audio processing routines on AliExpress that tracked users by analyzing how their devices handled digital sound—a technique that sidestepped browser privacy controls.
InfoQ
A coder investigating why Bluetooth headphones wouldn't switch focus between devices stumbled onto a privacy violation hidden inside Alibaba's homepage. The AliExpress website was running an inaudible audio stream that fingerprinted visitors by measuring how their hardware processed sound—a technique that evaded traditional tracking protections.
How the Tracking Worked#
Alibaba embedded fingerprinting code within its AWSC anti-bot security toolkit, deploying scripts that created a fake audio signal and fed it through the browser's Web Audio API. The chain of operations included an oscillator generating a triangle wave, a dynamics compressor, and an analyzer—all routed through a gain stage deliberately silenced to zero volume.
The key insight: because digital signal processing varies slightly across different processors, instruction sets (like AVX or ARM NEON), operating systems, and driver implementations, the mathematical output of this synthetic audio becomes a unique fingerprint for each device. Even with no audible sound, the frequency data extracted from the analysis stage reveals hardware-level quirks that identify users reliably.
According to Matt Callaghan, the developer who uncovered the scheme, the connection to the audio destination forced the operating system to maintain an active audio stream, which inadvertently locked Bluetooth multipoint routing and triggered the investigation.
Browser Vendors Deploy Different Defenses#
Privacy-focused browsers moved quickly to address the vulnerability. Brave uses a technique called "farbling," which injects random noise into audio buffers so frequency data changes unpredictably across sessions without breaking legitimate audio applications. Firefox takes a different approach through mathematical bucketing and canonical normalization, forcing audio processing into standardized precision bins that eliminate the hardware-level variance fingerprinting depends on.
As Brave noted publicly, "AliExpress wasn't recording users but instead playing a silent sound and measuring how users' specific devices processed it in order to fingerprint them."
